CVE-2026-31771: Linux Kernel Privilege Escalation Bug

CVE-2026-31771 Overview

CVE-2026-31771 is a Linux kernel vulnerability in the Bluetooth HCI (Host Controller Interface) event handling subsystem. The flaw exists in hci_store_wake_reason(), which is called from hci_event_packet() after the HCI event header is stripped but before hci_event_func() enforces the per-event minimum payload length defined in hci_ev_table. A short HCI event frame can therefore reach bacpy() before any bounds check executes, leading to an out-of-bounds read of attacker-controlled Bluetooth event data. The vulnerability is reachable from an adjacent network attacker within Bluetooth range.

Critical Impact
A malformed HCI event frame can trigger an out-of-bounds memory read in the Bluetooth stack, exposing kernel memory contents and potentially crashing the host.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_event.c)
Linux distributions shipping affected stable kernel branches prior to the fix commits
Devices with Bluetooth controllers using the hci_event_packet() code path

Discovery Timeline

2026-05-01 - CVE-2026-31771 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-31771

Vulnerability Analysis

The Linux kernel Bluetooth stack processes HCI events through hci_event_packet(). After stripping the HCI event header, the kernel calls hci_store_wake_reason() to record the wake-up address before dispatching the event to its registered handler in hci_ev_table. The per-event minimum payload length validation occurs inside hci_event_func(), which runs after the wake-reason logic.

This ordering creates a window where a truncated event frame is parsed by hci_store_wake_reason() without payload-length validation. The function calls bacpy() to copy a Bluetooth device address (bdaddr) from the socket buffer (skb), reading up to six bytes past the validated boundary. An attacker controlling Bluetooth traffic within radio range can craft short event frames that trigger the unchecked read.

The upstream fix moves wake-address storage into the individual event handlers, after each handler has already validated its event-specific payload length. hci_store_wake_reason() is converted into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). The helper is annotated with __must_hold(&hdev->lock) and includes lockdep_assert_held(&hdev->lock) to enforce the lock contract.

Root Cause

The root cause is missing input validation [CWE-20] combined with an out-of-bounds read [CWE-125]. hci_store_wake_reason() accessed skb data before per-event length checks ran, violating the assumption that callers had verified the payload size.

Attack Vector

An adjacent attacker within Bluetooth range can transmit malformed HCI events that the kernel forwards through hci_event_packet(). The attacker requires no authentication or user interaction. Successful exploitation reads adjacent kernel memory and may corrupt Bluetooth state or crash the host, denying service to the device.

No public proof-of-concept code is available. Technical details are described in the upstream commits referenced in the Linux Kernel stable tree commit 2b2bf47cd755 and Linux Kernel stable tree commit 86c8d07a64d5.

Detection Methods for CVE-2026-31771

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hci_store_wake_reason, hci_event_packet, or bacpy in dmesg or /var/log/kern.log
KASAN or slab-out-of-bounds reports tied to the Bluetooth subsystem
Repeated Bluetooth controller resets or HCI transport errors on devices in proximity to unknown Bluetooth peers

Detection Strategies

Audit installed kernel versions against vendor advisories to identify hosts running pre-patch builds of the Bluetooth stack
Enable KASAN on test kernels to surface out-of-bounds reads in hci_event.c during fuzzing or QA cycles
Correlate Bluetooth-related kernel warnings with proximity-based access events on laptops, embedded devices, and IoT endpoints

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging or SIEM platform and alert on Bluetooth subsystem faults
Monitor for unusual Bluetooth scan or connection activity originating near sensitive endpoints
Track package management events for kernel updates to confirm patch deployment across the fleet

How to Mitigate CVE-2026-31771

Immediate Actions Required

Apply the upstream Linux kernel patch that moves wake-reason storage into validated event handlers
Update to a distribution kernel that incorporates commits 2b2bf47cd755 and 86c8d07a64d5
Disable Bluetooth on systems that do not require it, especially servers and fixed-function devices

Patch Information

The fix is published in the Linux stable tree. Refer to Linux Kernel commit 2b2bf47cd755 and Linux Kernel commit 86c8d07a64d5. The patch relocates the wake-address copy into hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(), each running after their event-length validation succeeds.

Workarounds

Unload the bluetooth and btusb kernel modules on hosts that do not need Bluetooth connectivity
Blocklist Bluetooth modules in /etc/modprobe.d/ to prevent automatic loading at boot
Restrict physical and radio-range access to high-value endpoints until patches are deployed

bash

# Disable Bluetooth modules until the kernel is patched
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'install btusb /bin/true' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null || true